From 6e658c678c6a11d00c56368a54c01c58aef76c18 Mon Sep 17 00:00:00 2001
From: Carlos <835129+cvscarlos@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:56:08 +0200
Subject: [PATCH 1/6] fix: replace unavailable actionsx/prettier with the
 Prettier CLI

The actionsx/prettier repository is gone, so every job using it fails with
"Unable to resolve action actionsx/prettier, repository not found" before
running a step. Actions does not follow repository redirects, so bumping the
tag does not help.

Run the pinned Prettier CLI through npx instead. Calling repositories are not
necessarily Node projects, so the check must not depend on a package.json
being present. The additional_args branches collapse into a single step, and
the input now reaches the shell through env rather than being interpolated
into run.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/json.yaml |  4 +---
 .github/workflows/yaml.yaml | 17 ++++++-----------
 package-lock.json           | 13 +++++++------
 package.json                |  2 +-
 4 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/json.yaml b/.github/workflows/json.yaml
index 9f07637..c354472 100644
--- a/.github/workflows/json.yaml
+++ b/.github/workflows/json.yaml
@@ -20,6 +20,4 @@ jobs:
       - name: Checkout current git repository
         uses: actions/checkout@v7
       - name: Lint JSON
-        uses: actionsx/prettier@v3
-        with:
-          args: --check "**/*.json"
+        run: npx --yes prettier@3.9.6 --check "**/*.json"
diff --git a/.github/workflows/yaml.yaml b/.github/workflows/yaml.yaml
index 6babe49..30fcfb1 100644
--- a/.github/workflows/yaml.yaml
+++ b/.github/workflows/yaml.yaml
@@ -24,14 +24,9 @@ jobs:
       - name: Checkout current git repository
         uses: actions/checkout@v7
 
-      - name: Lint all YAML files
-        uses: actionsx/prettier@v3
-        if: ${{ inputs.additional_args == '' }}
-        with:
-          args: --check "**/*.{yaml,yml}"
-
-      - name: Lint some YAML files
-        uses: actionsx/prettier@v3
-        if: ${{ inputs.additional_args != '' }}
-        with:
-          args: --check "**/*.{yaml,yml}" "${{ inputs.additional_args }}"
+      - name: Lint YAML files
+        # Run prettier via npx: calling repos are not necessarily Node
+        # projects, so this must not depend on a package.json being present.
+        env:
+          ADDITIONAL_ARGS: ${{ inputs.additional_args }}
+        run: npx --yes prettier@3.9.6 --check "**/*.{yaml,yml}" $ADDITIONAL_ARGS
diff --git a/package-lock.json b/package-lock.json
index 3cd044f..8770052 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
         "husky": "^8.0.3",
         "is-ci": "^3.0.1",
         "lint-staged": "^13.1.0",
-        "prettier": "2.8.3"
+        "prettier": "3.9.6"
       },
       "engines": {
         "node": ">=v18.8.0"
@@ -2231,15 +2231,16 @@
       }
     },
     "node_modules/prettier": {
-      "version": "2.8.3",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.8.3.tgz",
-      "integrity": "sha512-tJ/oJ4amDihPoufT5sM0Z1SKEuKay8LfVAMlbbhnnkvt6BUserZylqo2PN+p9KeljLr0OHa2rXHU1T8reeoTrw==",
+      "version": "3.9.6",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz",
+      "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
       "dev": true,
+      "license": "MIT",
       "bin": {
-        "prettier": "bin-prettier.js"
+        "prettier": "bin/prettier.cjs"
       },
       "engines": {
-        "node": ">=10.13.0"
+        "node": ">=14"
       },
       "funding": {
         "url": "https://github.com/prettier/prettier?sponsor=1"
diff --git a/package.json b/package.json
index e173a36..48720fa 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,7 @@
     "husky": "^8.0.3",
     "is-ci": "^3.0.1",
     "lint-staged": "^13.1.0",
-    "prettier": "2.8.3"
+    "prettier": "3.9.6"
   },
   "lint-staged": {
     "**/*": "prettier --write --ignore-unknown"

From b33091efb1555968b27a7dff32afa94bd1a22e58 Mon Sep 17 00:00:00 2001
From: Carlos <835129+cvscarlos@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:56:11 +0200
Subject: [PATCH 2/6] chore: group and sort .gitignore entries

Split the entries into directories and files, sort each group, add the
missing trailing slashes, and drop the unused log/ rule.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .gitignore | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/.gitignore b/.gitignore
index f78e25c..fdcd0a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,19 +1,11 @@
-# Mac
-.DS_Store
-
-# Node
-node_modules
-
-# Windows
-Thumbs.db
-
-# Editor
+# Directories
 .idea/
-.vscode
+.vscode/
+node_modules/
+tmp/
 
-# vi
-*~
-
-# General
-log/
+# Files
 *.log
+*~
+.DS_Store
+Thumbs.db

From 9d15a64f1e3ca9ec5c5d9249490e74382c3d1f42 Mon Sep 17 00:00:00 2001
From: Carlos <835129+cvscarlos@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:57:52 +0200
Subject: [PATCH 3/6] fix: keep additional_args word splitting explicit for
 shellcheck

actionlint flags the unquoted expansion (SC2086), but the input is documented
as a list of globs, so word splitting is the intended behaviour. Quoting it
would collapse the list into a single argument.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/yaml.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/yaml.yaml b/.github/workflows/yaml.yaml
index 30fcfb1..38ea0d3 100644
--- a/.github/workflows/yaml.yaml
+++ b/.github/workflows/yaml.yaml
@@ -29,4 +29,6 @@ jobs:
         # projects, so this must not depend on a package.json being present.
         env:
           ADDITIONAL_ARGS: ${{ inputs.additional_args }}
-        run: npx --yes prettier@3.9.6 --check "**/*.{yaml,yml}" $ADDITIONAL_ARGS
+        run: |
+          # shellcheck disable=SC2086  # additional_args is a list of globs, so word splitting is intended
+          npx --yes prettier@3.9.6 --check "**/*.{yaml,yml}" $ADDITIONAL_ARGS

From 3071cbb01608838821ac467aaab02970ef83800a Mon Sep 17 00:00:00 2001
From: Carlos <835129+cvscarlos@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:07:52 +0200
Subject: [PATCH 4/6] ci: lint this repository with its own reusable workflows

The self-lint jobs called the workflows at @v9, so a PR was validated against
the last released tag instead of its own changes. Point them at the local
path so a change to yaml.yaml or json.yaml is exercised by the PR that makes
it. release.yaml stays pinned, since a broken branch must not break releases.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/ci.json.yaml | 3 ++-
 .github/workflows/ci.pr.yaml   | 4 +++-
 .github/workflows/ci.yaml.yaml | 3 ++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.json.yaml b/.github/workflows/ci.json.yaml
index cb90b94..e03375b 100644
--- a/.github/workflows/ci.json.yaml
+++ b/.github/workflows/ci.json.yaml
@@ -11,4 +11,5 @@ on:
   workflow_dispatch:
 jobs:
   lint:
-    uses: parcelLab/ci/.github/workflows/json.yaml@v9
+    # Lint with this repository's own copy, see ci.pr.yaml
+    uses: ./.github/workflows/json.yaml
diff --git a/.github/workflows/ci.pr.yaml b/.github/workflows/ci.pr.yaml
index 254cd72..8214b4b 100644
--- a/.github/workflows/ci.pr.yaml
+++ b/.github/workflows/ci.pr.yaml
@@ -24,4 +24,6 @@ jobs:
       - name: Run actionlint
         run: /home/runner/go/bin/actionlint
   yamllint:
-    uses: parcelLab/ci/.github/workflows/yaml.yaml@v9
+    # Lint with this repository's own copy so a PR validates its changes
+    # to the reusable workflow, not the last released tag.
+    uses: ./.github/workflows/yaml.yaml
diff --git a/.github/workflows/ci.yaml.yaml b/.github/workflows/ci.yaml.yaml
index cf27840..567cfd6 100644
--- a/.github/workflows/ci.yaml.yaml
+++ b/.github/workflows/ci.yaml.yaml
@@ -15,4 +15,5 @@ on:
   workflow_dispatch:
 jobs:
   lint:
-    uses: parcelLab/ci/.github/workflows/yaml.yaml@v9
+    # Lint with this repository's own copy, see ci.pr.yaml
+    uses: ./.github/workflows/yaml.yaml

From 98e1fca0c0af964925435598eced6ece7bd11feb Mon Sep 17 00:00:00 2001
From: Carlos <835129+cvscarlos@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:09:42 +0200
Subject: [PATCH 5/6] chore: drop comments that restate the code

The "see ci.pr.yaml" pointers duplicated what the ./ path already says and
would dangle if that file were renamed. The two surviving comments record a
decision the code cannot: why npx instead of npm ci, and why the local copy
instead of the released tag.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/ci.json.yaml | 1 -
 .github/workflows/ci.pr.yaml   | 3 +--
 .github/workflows/ci.yaml.yaml | 1 -
 .github/workflows/yaml.yaml    | 3 +--
 4 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.json.yaml b/.github/workflows/ci.json.yaml
index e03375b..bef011a 100644
--- a/.github/workflows/ci.json.yaml
+++ b/.github/workflows/ci.json.yaml
@@ -11,5 +11,4 @@ on:
   workflow_dispatch:
 jobs:
   lint:
-    # Lint with this repository's own copy, see ci.pr.yaml
     uses: ./.github/workflows/json.yaml
diff --git a/.github/workflows/ci.pr.yaml b/.github/workflows/ci.pr.yaml
index 8214b4b..36c8e2f 100644
--- a/.github/workflows/ci.pr.yaml
+++ b/.github/workflows/ci.pr.yaml
@@ -24,6 +24,5 @@ jobs:
       - name: Run actionlint
         run: /home/runner/go/bin/actionlint
   yamllint:
-    # Lint with this repository's own copy so a PR validates its changes
-    # to the reusable workflow, not the last released tag.
+    # Local copy, not @v9: a PR must validate its own workflow changes.
     uses: ./.github/workflows/yaml.yaml
diff --git a/.github/workflows/ci.yaml.yaml b/.github/workflows/ci.yaml.yaml
index 567cfd6..b38ea4c 100644
--- a/.github/workflows/ci.yaml.yaml
+++ b/.github/workflows/ci.yaml.yaml
@@ -15,5 +15,4 @@ on:
   workflow_dispatch:
 jobs:
   lint:
-    # Lint with this repository's own copy, see ci.pr.yaml
     uses: ./.github/workflows/yaml.yaml
diff --git a/.github/workflows/yaml.yaml b/.github/workflows/yaml.yaml
index 38ea0d3..8c08c07 100644
--- a/.github/workflows/yaml.yaml
+++ b/.github/workflows/yaml.yaml
@@ -25,8 +25,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Lint YAML files
-        # Run prettier via npx: calling repos are not necessarily Node
-        # projects, so this must not depend on a package.json being present.
+        # npx, not npm ci: calling repositories may have no package.json.
         env:
           ADDITIONAL_ARGS: ${{ inputs.additional_args }}
         run: |

From d74ec70ff2db71f441b310411a3b9b3e16b1ac99 Mon Sep 17 00:00:00 2001
From: Carlos <835129+cvscarlos@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:24:31 +0200
Subject: [PATCH 6/6] fix: provision node and stop bash expanding the prettier
 globs

The action this replaced ran in a container, so it did not need node on the
runner. npx does, and the runner input accepts arbitrary values, so set up
node explicitly rather than relying on the image shipping it.

Also disable pathname expansion around additional_args. Word splitting is
wanted, glob expansion is not: bash was resolving the patterns against the
checkout before prettier saw them, and collapsing ** to a single level. The
first pattern was already quoted for this reason. Add -- so a pattern cannot
be read as an option.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/json.yaml |  6 +++++-
 .github/workflows/yaml.yaml | 12 ++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/json.yaml b/.github/workflows/json.yaml
index c354472..6f581ed 100644
--- a/.github/workflows/json.yaml
+++ b/.github/workflows/json.yaml
@@ -19,5 +19,9 @@ jobs:
     steps:
       - name: Checkout current git repository
         uses: actions/checkout@v7
+      - name: Set up node environment
+        uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
       - name: Lint JSON
-        run: npx --yes prettier@3.9.6 --check "**/*.json"
+        run: npx --yes prettier@3.9.6 --check -- "**/*.json"
diff --git a/.github/workflows/yaml.yaml b/.github/workflows/yaml.yaml
index 8c08c07..7e97283 100644
--- a/.github/workflows/yaml.yaml
+++ b/.github/workflows/yaml.yaml
@@ -24,10 +24,18 @@ jobs:
       - name: Checkout current git repository
         uses: actions/checkout@v7
 
+      - name: Set up node environment
+        uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
+
       - name: Lint YAML files
         # npx, not npm ci: calling repositories may have no package.json.
         env:
           ADDITIONAL_ARGS: ${{ inputs.additional_args }}
         run: |
-          # shellcheck disable=SC2086  # additional_args is a list of globs, so word splitting is intended
-          npx --yes prettier@3.9.6 --check "**/*.{yaml,yml}" $ADDITIONAL_ARGS
+          # Split additional_args into words, but leave the globs for Prettier
+          # to interpret rather than letting bash expand them against the repo.
+          set -f
+          # shellcheck disable=SC2086
+          npx --yes prettier@3.9.6 --check -- "**/*.{yaml,yml}" $ADDITIONAL_ARGS